BUILD_EXIT=0
=== DF-1827 isc_sendPDU MH_ALIGN overflow harness ===
MHLEN (this demo)        = 160
sizeof(union ipdu_u)     = 48 (BHS)
MH_ALIGN -> m_data at    = m_pktdat[112] (BHS at end of buf)
trailing bytes after BHS = 0
attacker ahs_len         = 64
header digest            = 4

isc_soc.c:125 bcopy(ahs, m_data+48, 64):
  writes m_pktdat[160..224), buffer ends at 160 -> 64 bytes OOB
isc_soc.c:138 bcopy(hdr_dig, m_data+112, 4):
  writes m_pktdat[224..228), buffer ends at 160 -> 68 bytes OOB

VERDICT: BUG CONFIRMED. MH_ALIGN(mh, BHS) leaves no room for
        AHS or header digest. Both isc_soc.c:125 and :138
        bcopy()s write past m_pktdat into the next heap object.
        ahs_len is attacker-supplied via ISCSISEND; the 4-byte
        digest overflow happens every PDU. Fix: MH_ALIGN(mh,
        hdrlen) where hdrlen = BHS + ahs_len + digest, and
        reject hdrlen > MHLEN.
RUN_EXIT=0